CVE Feed
Latest CVEs
Every CVE as it lands, mapped to the product it affects. Filter by time, severity and exploitation.
Updated Oct 29, 23:15 UTC
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-27809 | PS psd-tools psd-tools | 9.1 | Feb 25 | psd-tools: Compression module has unguarded zlib decompression, missing dimension validation, and hardening gaps |
| CVE-2026-27804 | PA parse-server parse-community | 9.1 | Feb 25 | Parse Server: Account takeover via JWT algorithm confusion in Google auth adapter |
| CVE-2026-27613 | TI TinyWeb maximmasiutin | 9.8 | Feb 25 | CGI Parameter Injection (Bypass of STRICT_CGI_PARAMS and EscapeShellParam) |
| CVE-2026-27577 | N8 n8n n8n-io | 9.9 | Feb 25 | n8n: Expression Sandbox Escape Leads to RCE |
| CVE-2026-27495 | N8 n8n n8n-io | 9.9 | Feb 25 | n8n has a Sandbox Escape in its JavaScript Task Runner |
| CVE-2026-27494 | N8 n8n n8n-io | 9.9 | Feb 25 | n8n has Arbitrary File Read via Python Code Node Sandbox Escape |
| CVE-2026-27493 | N8 n8n n8n-io | 9.0 | Feb 25 | n8n has Unauthenticated Expression Evaluation via Form Node |
| CVE-2026-27148 | ST storybook storybookjs | 9.6 | Feb 25 | Storybook Dev Server Vulnerable to WebSocket Hijacking |
| CVE-2026-27575 | VI vikunja go-vikunja | 9.1 | Feb 25 | Vijkunja has Weak Password Policy Combined with Persistent Sessions After Password Change |
| CVE-2026-25997 | FR FreeRDP FreeRDP | 9.8 | Feb 25 | FreeRDP has heap-use-after-free in xf_clipboard_format_equal |
| CVE-2026-25959 | FR FreeRDP FreeRDP | 9.8 | Feb 25 | FreeRDP has heap-use-after-free in xf_cliprdr_provide_data_ |
| CVE-2026-0542 | SA ServiceNow AI Platform ServiceNow | 9.2 | Feb 25 | Remote Code Execution in ServiceNow AI Platform |
| CVE-2026-25955 | FR FreeRDP FreeRDP | 9.8 | Feb 25 | FreeRDP has heap-use-after-free in xf_AppUpdateWindowFromSurface (stale XImage) |
| CVE-2026-25953 | FR FreeRDP FreeRDP | 9.8 | Feb 25 | FreeRDP has heap-use-after-free in xf_AppUpdateWindowFromSurface (freed appWindow) |
| CVE-2026-25952 | FR FreeRDP FreeRDP | 9.8 | Feb 25 | FreeRDP has heap-use-after-free in xf_SetWindowMinMaxInfo |
| CVE-2026-22720 | VA VMware Aria Operations VMware | 9.0 | Feb 25 | VMware Aria Operations stored cross-site scripting vulnerability |
| CVE-2026-21902 | JO Junos OS Evolved Juniper Networks | 9.8 | Feb 25 | Junos OS Evolved: PTX Series: A vulnerability allows a unauthenticated, network-based attacker to execute code as root |
| CVE-2026-27739 | NG @nguniversal/common angular | 9.2 | Feb 25 | Angular SSR is vulnerable to SSRF and Header Injection via request handling pipeline |
| CVE-2026-27849 | MR MR9600 Linksys | 9.8 | Feb 25 | Missing neutralization in Linksys MR9600, Linksys MX4200 |
| CVE-2026-20127 In wildKEV | CC Cisco Catalyst SD-WAN Manager Cisco | 10.0 | Feb 25 | Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability |
| CVE-2026-20129 | CC Cisco Catalyst SD-WAN Manager Cisco | 9.8 | Feb 25 | Cisco Catayst SD-WAN Authentication Bypass Vulnerability |
| CVE-2026-27727 | MC mchange-commons-java swaldman | 9.8 | Feb 25 | mchange-commons-java: Remote Code Execution via JNDI Reference Resolution |
| CVE-2025-1242 | HK Home Kit Gardyn | 9.1 | Feb 25 | Administrative Credentials Can Be Extracted Through Gardyn API Responses |
| CVE-2026-27848 | MR MR9600 Linksys | 9.8 | Feb 25 | Missing neutralization in Linksys MR9600, Linksys MX4200 |
| CVE-2026-27702 | BU budibase Budibase | 9.0 | Feb 25 | Budibase Vulnerable to Remote Code Execution via Unsafe eval() in View Filter Map Function (Budibase Cloud) |
| CVE-2026-27847 | MR MR9600 Linksys | 9.8 | Feb 25 | Missing authentication in Linksys MR9600, Linksys MX4200 |
| CVE-2026-27699 | BA basic-ftp patrickjuchli | 9.8 | Feb 25 | Basic FTP has Path Traversal Vulnerability in its downloadToDir() method |
| CVE-2026-3187 | SZ sz-boot-parent feiyuchuixue | 9.8 | Feb 25 | feiyuchuixue sz-boot-parent API Endpoint upload unrestricted upload |
| CVE-2026-2624 | AN Antikor Next Generation Firewall (NGFW) ePati Cyber Security Technologies Inc. | 9.8 | Feb 25 | Authentication Bypass in ePati's Antikor NGFW |
| CVE-2026-0704 | OS Octopus Server Octopus Deploy | 9.1 | Feb 25 | In affected version of Octopus Deploy it was possible to remove files and/or contents of files on the host using an API endpoint |
| CVE-2025-62878 | RA Rancher SUSE | 9.9 | Feb 25 | Local Path Provisioner vulnerable to Path Traversal via parameters.pathPattern |
| CVE-2026-3164 | NP News Portal Project itsourcecode | 9.8 | Feb 25 | itsourcecode News Portal Project contactus.php sql injection |
| CVE-2026-25785 | LE Lanscope Endpoint Manager (On-Premises) Sub-Manager Server MOTEX Inc. | 9.8 | Feb 25 | Path traversal vulnerability exists in Lanscope Endpoint Manager (On-Premises) Sub-Manager Server Ver.9.4.7.3 and earlier, which may allow an attacker to tamper with arbitrary… |
| CVE-2026-3153 | DM Document Management System itsourcecode | 9.8 | Feb 25 | itsourcecode Document Management System register.php sql injection |
| CVE-2026-3152 | CM College Management System itsourcecode | 9.8 | Feb 25 | itsourcecode College Management System teacher-salary.php sql injection |
| CVE-2026-3151 | CM College Management System itsourcecode | 9.8 | Feb 25 | itsourcecode College Management System login.php sql injection |
| CVE-2026-3148 | SA Simple and Nice Shopping Cart Script SourceCodester | 9.8 | Feb 25 | SourceCodester Simple and Nice Shopping Cart Script signup.php sql injection |
| CVE-2026-27597 | EN enclave agentfront | 10.0 | Feb 25 | @enclave-vm/core is vulnerable to Sandbox Escape |
| CVE-2026-27641 | FL flask-reuploaded jugmac00 | 9.8 | Feb 25 | Flask-Reuploaded vulnerable to Remote Code Execution via Server-Side Template Injection |
| CVE-2026-27637 | FR freescout freescout-help-desk | 9.8 | Feb 25 | FreeScout's Predictable Authentication Token Enables Account Takeover |
| CVE-2026-27743 | RE referer_spam SPIP | 9.8 | Feb 25 | SPIP referer_spam < 1.3.0 Unauthenticated SQL Injection |
| CVE-2026-27744 | TI tickets SPIP | 9.8 | Feb 25 | SPIP tickets < 4.3.3 Unauthenticated RCE |
| CVE-2026-27626 | OL OliveTin OliveTin | 9.9 | Feb 25 | OliveTin vulnerable to OS Command Injection via `password` argument type and webhook JSON extraction bypasses shell safety checks |
| CVE-2026-27607 | RU rustfs rustfs | 9.1 | Feb 25 | RustFS's Missing Post Policy Validation leads to Arbitrary Object Write |
| CVE-2026-27606 | RO rollup rollup | 9.8 | Feb 25 | Rollup 4 has Arbitrary File Write via Path Traversal |
| CVE-2026-3135 | NP News Portal Project itsourcecode | 9.8 | Feb 25 | itsourcecode News Portal Project add-category.php sql injection |
| CVE-2025-69771 | AS Asbplayer Killergerbah | 9.6 | Feb 25 | Cross-Site Scripting (XSS) vulnerability in the subtitle loading function of the asbplayer Chrome Extension version 1.14.0 allows attackers to execute arbitrary JavaScript in the… |
| CVE-2026-3134 | NP News Portal Project itsourcecode | 9.8 | Feb 24 | itsourcecode News Portal Project edit-category.php sql injection |
| CVE-2026-3133 | DM Document Management System itsourcecode | 9.8 | Feb 24 | itsourcecode Document Management System Login loging.php sql injection |
| CVE-2026-22553 | MB MasterSCADA BUK-TS InSAT | 9.8 | Feb 24 | InSAT MasterSCADA BUK-TS OS Command Injection |